Quantum cryptography device and method

ABSTRACT

A system and method for communicating a key between two stations using an interferometric system for quantum cryptography. The method includes sending at least two light pulses over a quantum channel and detecting the interference created by the light pulses. The interfering pulses traverse the same arms of an interferometer but in a different sequence such that the pulses are delayed when traversing a quantum channel. The pulses are reflected by Faraday mirrors at the ends of the quantum channel so as to cancel any polarization effects. Because the interfering pulses traverse the same arms of an interferometer, there is no need to align or balance between multiple arms of an interferometer.

This is a continuation of International Appln No. PCT/EP97/04575 whichclaims benefit of Provisional appln. No. 60/025,839 filed Sep. 5, 1996.

This invention relates to an optical communication system and methodconfigured for the distribution of a key using quantum cryptography.

PRIOR ART

The purpose of cryptography is to exchange messages in perfect privacybetween two users, conventionally known as Alice and Bob. Cryptographymethods often use a publicly announced encrypting and decryptingalgorithm; the confidentiality of the information relies entirely on akey which must be used as an input to the decrypting algorithm fordecrypting the received messages.

The key usually consists of a randomly chosen, sufficiently long stringof bits. Once the key is established, subsequent messages can betransmitted safely over a public channel. However, two users wanting tocommunicate must at a certain stage use a secure channel to share thekey. With conventional key transmission methods, which can be subject topassive monitoring by an eavesdropper, it is impossible to transmit acertifiably secret key, and cumbersome physical security measures arerequired. However, secure key distribution is possible using quantumtechniques. In quantum cryptography, the key is exchanged through aquantum channel. Its security is based on the principles of quantummechanics which state that any measurement of a suitably chosen quantumsystem will inevitably modify the quantum state of this system.Therefore, an eavesdropper, Eve, might get information out of a quantumchannel by performing a measurement, but the legitimate users willdetect her and hence not use the key. In practice the quantum system maybe a single photon propagating through an optical fiber, and the key canbe encoded by its polarization or by its phase, as proposed by Ch.Bennett and G. Brassard in <<Quantum Cryptography: Public keydistribution and coin tossing>>, Proceedings of the InternationalConference on Computers, Systems and Signal Processing, Bangalore,India, 1984, pp. 175-179 (IEEE, New York, 1984).

Interferometric quantum key distribution systems are usually based on adouble Mach-Zehnder interferometer, one side for Alice and one for Bob(see FIG. 1). These interferometers implement time-multiplexing, as bothinterfering pulses follow the same path between Alice and Bob, with sometime delay. However, the pulses follow different paths within bothAlice's and Bob's interferometers. In order to obtain a goodinterference, both users therefore need to have identicalinterferometers, with the same coupling ratios in each arm and the samepath lengths, and also need to keep them stable within a few tens ofnanometers during a transmission. Therefore, one interferometer has tobe adjusted to the other every few seconds to compensate thermal drifts.Moreover, since optical components like phase modulators arepolarization dependent, polarization control is necessary both in thetransmission line and within each interferometer. In polarization-basedsystems, the polarization has to be maintained stable over tens ofkilometers, in order to keep aligned the polarizers at Alice's andBob's. Obviously, this is inconvenient for practical applications.

One technical problem the invention wishes to solve is thus to find animproved device and an improved method of quantum cryptography.

According to various aspects of the present invention, theseimprovements follow from the features of the characterizing part of theindependent claims.

More specifically, these improvements follow from one system in whichthe interfering pulses run over the same branches of the interferometer,but in another sequence, so that they are delayed in time when they runover said quantum channel.

The system of the invention thus allow a system to be built which needsno alignment or balancing of the interferometer. Using the system of theinvention, Alice and Bob can thus exchange information, e.g. acryptographic key, through a standard telecommunication channel. Theusers at both ends of a channel only need to plug in the inventivesending/receiving station and the inventive key encoding station,synchronize their signals, and start the exchange.

According to another aspect of the present invention, cancellation ofpolarization effects is obtained by using Faraday mirrors at the end ofthe fibers.

The invention will be explained in more detail, by way of example, withreference to the drawings in which:

FIG. 1 is a schematic representation of a conventional Mach-Zehnderinterferometer for quantum cryptography, according to the prior art.

FIG. 2 is a schematic representation of a first embodiment of a deviceaccording to the invention.

FIG. 3 is a schematic representation of a second embodiment of a deviceaccording to the invention.

FIG. 4 is a schematic representation of a third embodiment of a deviceaccording to the invention.

FIG. 1 shows a block diagram of a conventional Mach-Zehnderinterferometer for quantum cryptography, as described for instance inU.S. Pat. No. 5,307,410 (Benett). A laser source 40 in Alice's deviceemits a short laser pulse toward Bob. The laser pulse is split into twotime-shifted pulses P1 and P2 by Alice: one goes through a short pathand through a phase-modulator 42; and the second is delayed by a longerpath 43. Two couplers (beam-splitters) 41 and 44 are needed to split thelaser pulse. Information about the key is encoded in the phase shiftintroduced by the phase modulator 42.

After propagation along the optical fiber 3, the two time-shifted pulsesP1 and P2 arrive in a similar interferometer on Bob's side, creatingthree pulses. The first pulse is produced from P1 running over a shortbranch, comprising a phase modulator 51, on Bob's side. The last pulseis produced from P2 running over a delaying part 52 on Bob's side. Thosetwo pulses carry no information on the phase setting. The middle pulseis obtained by interference between P1 running over the delay line onBob's side with P2 running over the short branch 51. The relative phasesettings creates a constructive or destructive interference in thedetectors 55 and 56.

In order to obtain a good visibility, the two interferometers 4 and 5have to be kept identical, and should preserve polarization. Inparticular, the length of the delay lines 43, 52 in both interferometersmust be exactly the same. This is usually done, according to the priorart, by adjusting one interferometer to the other every few seconds tocompensate thermal drifts.

A first embodiment of an optical communication system configured for thedistribution of a key using quantum cryptography according to theinvention, implementing phase-encoded quantum key distribution, andbased on time multiplexing, is shown on FIG. 2. This embodiment featuresa 2×2 coupler 12. In principle, we have an unbalanced Michelsoninterferometer at Bob's side (1) with one long arm going to Alice. OnBob's side, the sending/receiving station I comprises a pulsed laser 10,a first coupler 11, a Faraday mirror 16, a second coupler 12, a phasemodulator 13, a second Faraday mirror 14 and a single photon detector17. The laser 10 may be, e.g., a DFB laser and produces e.g. 300 ps longpulses at 1300 nm, with a repetition rate of e.g. 1 kHz. On Alice'sside, the key encoding station 2 comprises a coupler 20, a detector 23,a phase modulator 21, a Faraday mirror 22 and an attenuator 24controlled by the detector 23. Alice and Bob's device are coupled onboth side of a quantum channel 3, for example, on both sides of anoptical channel comprising a single mode optical fiber.

Bob initiates the transmission by sending a short laser pulse towardsAlice. Let us for the moment disregard the effects of the Faradaymirrors 16, 14, 22, and consider them as usual mirrors. The need forcoupler 20 and detector 23 in Alice's arm will also be explained later.The pulse arriving in the coupler 12 is split into two parts: one part,P1, goes directly towards Alice; while the second part, P2, is firstdelayed by one bounce in the mirrors 14 and 16 (delay line). The twopulses, P1 and P2, travel down the fiber to Alice. In order to encodeher bits, Alice lets the first pulse P1 be reflected by the mirror 22,but modulates the phase of the second pulse P2 by means of a phasemodulator 21 situated in front of the mirror 22 (phase shift ø_(A)). Thetwo pulses then travel back to Bob. Detection on Bob's side is done bydelaying part of P1 in the same delay line 14-16. Bob lets pulse P2unaltered but modulates the phase of the first pulse P1 with the phasemodulator 13 situated in front of the mirror 14 (phase shift ø_(B)).This pulse then interferes with P2. If the phase modulators at bothAlice's and Bob's are off, or if the difference ø_(A)−ø_(B)=0 (samephase shift applied to the two pulses P1 and P2), then the interferencewill be constructive (the two pulses follow exactly the same path). Ifhowever Alice or Bob change their phase setting between the two pulses,the interference may become destructive. Totally destructiveinterference is obtained when: ø_(A)−ø_(B)=π, where ø_(A) and ø_(B) arethe total phase shifts introduced by Alice and Bob respectively, i.e.the phase shifts corresponding to a return trip through the phasemodulators. In this case no light is detected at single photon detector17. Note that it is essential that the interference obtained when thephase shifts are different is totally destructive. This ensures that,when Bob obtains a detection event, he can be certain that Alice did notuse a different phase, and thus that she used the same phase as himself.

This shows that the relative phase setup modulates the intensity in thedetector 17, and thus can be used to transfer information from Alice toBob. The first attractive features of this setup are that theinterferometer is automatically aligned (both pulses are delayed by thesame delay line), and that the visibility of the fringes is independentof the transmission/reflection coefficients of the coupler 12.

Of course, a large fraction of the light does not follow these twopaths, but is split differently at various couplers (e.g. keepsoscillating a few times between 14-16 or 16-22 before leaving towardsthe detector 17). These pulses will eventually arrive in the detector17, but at a different time, and will be easily discriminated.Therefore, they do not reduce the visibility. Of particular interest isthe fraction of P1 coming back from Alice to Bob, and which goesdirectly onto the detector 17, thus arriving before the two interferingpulses. We shall show in the following that this pulse is required toprevent some type of eavesdropping strategy. Please note that, as thedistance between Alice and Bob is much longer than the length of Bob'sinterferometer, the time delay between the two pulses arriving in Bob'ssetup (i.e. the time between P2 leaving and P1 coming back) is muchlonger than the time between the pulses in Alice's setup: a span of 10km between Alice and Bob corresponds to 0.1 ms. This means that Bob'sstation needs to remain stable for times longer than that, but this isnot a problem for a short interferometric system. On the other hand,assuming a distance between the mirrors 14 and 16 of 3 m, the time delaybetween the pulses arriving at Alice's is only 30 ns. This means thatthere is absolutely no problem of stability, even for a very longtransmission line. However, in order to encode her bits, Alice needs tohave a fast phase modulator 21 (about 100 MHz). This fast modulation isneeded in order to be able to modulate the phase of the pulse P2arriving at Alice's, without altering the phase of P1. This is noproblem with existing Lithium Niobate (LiNbO₃) modulators. A similar, orslower, phase modulator may be used on Bob's side. Other phasemodulators are described in WO96/07951.

The above setup would work perfectly well for ideal fibers, with nobirefringence. Unfortunately, all existing optical fibers havebirefringence, which will modify the state of polarization of the light,and may lead to a reduction in the visibility of the interference. Inorder to preserve interference, we use instead of usual mirrorsso-called Faraday mirrors 14, 16, 22. A Faraday mirror is simply anordinary mirror, glued on a Faraday rotator, which rotates thepolarization by 45°.

The effect of a Faraday mirror is to transform any polarization stateinto its orthogonal, i.e., the polarization state of the reflected pulseon each point of the optical fiber is orthogonal to the polarizationstate of the received pulse. Replacing ordinary mirrors 14 and 16 byFaraday mirrors (i.e., adding the Faraday rotators) thus ensures thatthe two pulses P1 and P2 have the same polarization, irrespective ofbirefringence effects in the delay line 14-16. Therefore, thepolarization state of the pulse P2 is unchanged by the double bounce onthe Faraday mirrors 14 and 16, and similarly for the state of P1,bouncing on the Faraday mirrors 16 and 14 on its way to the detector 17.Note that the above is not necessarily true for the pulses P1 and P2propagating down the long transmission fiber (several kilometers long).Due to the influence of the earth magnetic field, which creates a smallFaraday effect in the fiber itself, and of possible rapid fluctuationsin the birefringence, the polarization state of the returning pulses isnot necessarily orthogonal to the input polarization state. However,what is important in our setup is that the two interfering pulses P1 andP2 have the same polarization.

Use of a Faraday mirror 22 in Alice's enables one to compensate for thepolarization dependence of the phase modulator 21, as well as forpolarization dependent losses.

Until now, we have only discussed macroscopic pulses. In order to getquantum cryptographic security, the information carrying pulses need tobe very weak, with at most one photon per pulse, as explained by C. H.Benett, G. Brassard and A. K Ekert, <<Quantum Cryptography>>, ScientificAmerican 267, pp. 50-57, 1992. This is to prevent a malevolenteavesdropper, known as Eve, to divert part of the pulse and getinformation on the key. In practice, we rely on strongly attenuatedlaser light. Since the photon distribution of this light is Poissonian,in order to ensure that the probability of more than one photon is weakenough, we use about 0.1 photon per pulse on average. This attenuationmay be obtained by adding the extra strongly transmitting coupler 20 inAlice's arm with a transmission coefficient t₃≈1. This creates enoughattenuation on the beams reflected by the mirror 22 to have asingle-photon-like pulse sent back to Bob, as well as maximizes theintensity going to the detector 23, and thus enables an ordinarydetector 23 to be used, and not a single-photon one. If the attenuationis not sufficient, Alice may add an extra attenuator 24, controlled bythe detector 23, in front of her setup. Using the detector 23, Alice canmonitor the intensity of the incoming pulses, and control theattenuation to ensure that the pulse P2 going back to Bob has indeed thecorrect intensity. (Remember that the pulses going from Bob to Alice donot carry any phase information yet; it is only on the way back to Bobthat the phase chosen by Alice is encoded in the pulse P2.

Monitoring the incoming intensity has the added advantage that Alice candetect any attempt by Eve to obtain the value of her phase shift bysending much stronger pulses in the system, and measuring the phase ofthe reflected pulses.

On Bob's side, the light detector 17 needs to be a single-photondetector, for instance an LN₂-cooled avalanche photo diode biased beyondbreakdown and operating in the Geiger mode. The bias voltage of thediode is the sum of a DC part well below threshold and a short, forinstance 2 ns, rectangular pulse that pushes the diode e.g. 1.0 V overthreshold when a photon is expected. This time window allows the numberof darkcounts to be reduced considerably and for discriminating nonrelevant pulses. Furthermore, in order to obtain as much of the light aspossible on the detector 17, the coupler 11 has to be stronglytransmitting, with transmission coefficient t₁≈1.

This system can be used to implement B92 protocol, or two-statesprotocol, suggested by C. H. Bennet in <<Quantum Cryptography Using AnyTwo Nonorthogonal States>>, Physical Review Letters 68, pp. 3121-3124,1992. Both Alice and Bob choose at random their phase settings, so thatthe overall phase shifts in the phase modulators 13 and 21 are 0 or π,corresponding, respectively, to bit value 0 and 1. Note that these areoverall phase shifts, corresponding to the return trip of the pulses.Therefore, if a detection, i.e. constructive interference, occurred,Alice and Bob know that they applied the same phase shift, and that theyhad the same bit value: if Bob chooses bit 0, and gets one count in hisdetector, he knows that Alice has also sent a 0, and reciprocally forbit 1.

If Alice and Bob use different phase shifts, the difference is always π,which means that the interference in the single photon detector 17 isalways destructive, and that no count should be registered. Of course,since they use very weak pulses, in many instances Bob would get nocount in the detector 17. In this case, he cannot infer what was sent byAlice: it could be that Alice used a different phase; or it could bethat there was simply no photon in the pulse. We can now understand whyvery weak pulses are needed: if Alice and Bob use strong pulses, whichalways carry more than one photon, Bob would always know the bit sent byAlice: one count, same choice of phase; no count, different choice ofphase. Unfortunately, so would Eve. For example, she could simply splitthe pulses, by adding an extra coupler on the line, and by measuring thephase of the pulses sent by Alice. However, if the pulse sent by Alicepossesses at most one photon, this simple eavesdropping strategy failscompletely: if Eve measures the photon, then Bob will not get it, andwould simply discard the corresponding transmission.

Another eavesdropping strategy on two-state systems would be for Eve tostop the transmission altogether, measure as many pulses as she could,and send to Bob only the ones she managed to obtain. To prevent this,Alice needs to send both a strong pulse P1, as a reference, and a weakone P2, containing the phase information. Eve cannot suppress the strongpulse without being immediately discovered. If she suppresses only theweak one, because she did not obtain the phase information, the strongpulse alone will introduce noise in the detector 17. In the system ofthe invention, this is easily implemented by using a strongly asymmetriccoupler 12, with transmission coefficient t₂≈1, and reflectioncoefficient r₂≈0. In this case, the pulse P1 going back towards Bob ismuch stronger than the pulse P2, which has already been through the14-16 delay line, and thus was strongly attenuated. Bob can detect thepart of the pulse P1 going directly to the detector 17, before lookingat the interference. It is also possible to add an extra coupler anddetector in front of the Faraday mirror 16, in a way similar to Alice'ssetup.

The same setup, but with different choices of phase for Alice and Bobcan be used to implement other protocols, such as the BB84 protocoldescribed by Ch. Bennett and G. Brassard in <<Quantum Cryptography:Public key distribution and coin tossing>>, Proceedings of theIntemational Conference on Computers, Systems and Signal Processing,Bangalore, India, 1984, pp. 175-179 (IEEE, New York, 1984). According tothis protocol, Alice chooses among four possible states. In anotherexample, if Alice's phase shifts are not 0 and π/₂, but 0 and any angleα, it is easy for Bob to compensate by using π−α and π, so that when Bobuses the wrong phase shift, the interference is totally destructive.

FIG. 3 shows a block diagram of a second embodiment of an opticalcommunication system according to the invention, configured for thedistribution of a key using quantum cryptography and implementingphase-encoded quantum key distribution. This embodiment features a 3×3coupler 12′. On Alice's side, the same key encoding station 2 as in thefirst embodiment can be used. On Bob's side, the sending/receivingstation 1 comprises a laser 10, a 3×3 coupler 12′, a first Faradaymirror 14, a second Faraday mirror 16, and two single-photon detectors17 and 18.

The first pulse P1 follows the following sequence of branches:

Laser 10−mirror 16−mirror 22 (on Alice's)−mirror 16 (on Bob's)−mirror14−detectors 17, 18.

The other pulse P2 follows the following sequence of branches:

Laser 10−mirror 16−mirror 14−mirror 16 −mirror 22 (on Alice's) and tothe detectors 17, 18.

Depending on the phase difference between the pulses P1 and P2, aconstructive interference will be detected either on the detector 17 oron the detector 18. The choice of phase by Alice, either π/₃ or −π/₃sends the photon either in the detector 17 or in the detector 18respectively.

The main advantage of using two detectors 17 and 18 is that we do notneed a second phase modulator on Bob's side to implement the B92protocol. The drawback is the need for two single photon detectors 17and 18.

Adding a second phase modulator before the Faraday mirror 14, as in theprevious system, enables the BB84 system to be efficiently implemented:Alice chooses among the four possible phases: π/₃, −π/₃, 2π/₃ and −2π/₃;while Bob chooses only between 0 (which enables him to differentiatebetween π/₃ and −π/₃), and π(which enables him to differentiate between2π/₃ and −2π/₃).

FIG. 4 shows a block diagram of a third embodiment of an opticalcommunication system according to the invention, configured for thedistribution of a key using quantum cryptography and implementingpolarization-encoded quantum key distribution. This embodiment featuresa polarization coupler 12″ on Bob's side.

On Alice's side, the same key encoding station 2 as in the firstembodiment can be used. On Bob's side, the sending/receiving station 1comprises a laser 10, a polarization controller 100, a first coupler 11,a polarization coupler 12″, a first Faraday mirror 14, a second Faradaymirror 16, and a single-photon polarization detection system 17′. Again,no phase modulator is needed on Bob's side.

The laser 10 uses a polarization controller 100 to send the light withe.g. right circular polarization. The polarization coupler 12″ separatesthe vertical and horizontal polarizations. One of the polarizationcomponents, say the vertical one, follows the following sequence ofbranches (with a polarization switch from vertical to horizontal, andvice versa, each time it is reflected by one of the Faraday mirrors):

Laser 10−mirror 22 (on Alice's)−mirror 16 (on Bob's)−mirror14−polarization detection system 17′.

On the other hand, the other polarization component (the horizontal one)follows the sequence:

Laser 10−mirror 14−mirror 16−mirror 22 (on Alice's) and to the detectionsystem 17′.

When the two orthogonally polarized pulses recombine at the polarizationcoupler 12′, the polarization of the outgoing pulse depends on theirrelative phase. For example, a zero phase shift corresponds to rightcircular polarization (identical to the initial one), while a π phaseshift corresponds to left circular polarization, and ±π/2 phase shiftsgive linear polarization at ±45°. A phase change in the phase modulator21 thus corresponds to a different output polarization. This embodimentthus does not require a second phase modulator on Bob's side, even forthe BB84 protocol. Moreover, by using four different choices of phase inthe phase modulator 21, four different states can be encoded. Thedrawback of this embodiment is that it requires a more complicateddetection system 17′ which can separate the various polarizations.Furthermore, it does require the polarization of the returning pulses tobe orthogonal to the polarization of the incoming ones. Therefore, fastpolarization fluctuations and the influence of the earth magnetic fieldmay limit the length of the transmission line 3.

Even good single-photon detectors makes errors and occasionally missphotons or count one photon when no photon is actually received(darkcounts). Error correction means, for instance using cyclicredundancy checks, may therefore be provided in Bob's.

Even if the sending/receiving station 1 and the key communicatingstation 2 are shown as two separates devices in the above specification,it can also be useful to combine a sending/receiving station and a keycommunicating station in the same device. This combined device can thenalternatively play the role of Bob or of Alice, i.e. initiate a keytransmission or answer to another device and transmit a key.

Any embodiment of the system of the invention can be easily extended toa multi-stations system, i.e. to a system for distributing a keysimultaneously to several mutually connected stations, as suggested forinstance in WO95/07583.

The embodiment of FIG. 4 is particularly advantageous from this point ofview, as less delayed pulses are sent over the quantum channel.

What is claimed is:
 1. Method of communicating between two stationsusing an interferometric system for quantum cryptography, comprising:sending at least two light pulses over a quantum channel coupled to thetwo stations; and detecting interference created by said pulses in onestation; wherein said pulses traverse the same branches of theinterferometric system, each of said pulses traversing the same branchesin a different sequence so that said pulses are delayed when traversingsaid quantum channel.
 2. Method according to claim 1, wherein saidpulses are reflected by at least one Faraday mirror on at least one endof said quantum channel.
 3. Method according to claim 1 or claim 2,wherein the average number of photons in said pulses is less than
 1. 4.Method according to claim 1, wherein said pulses include a first pulseand a second pulse; and wherein said pulses are sent by a source in asending/receiving station which delays the second pulse with a delayline, and received by at least one key encoding station which phasemodulates the second pulse and reflects both pulses toward saidsending/receiving station which delays and phase modulates said firstpulse.
 5. Method according to claim 4, wherein said second pulse isattenuated in said key encoding station so that an average number ofphotons in said second pulse reflected back to said sending/receivingstation is less than
 1. 6. Method according to one of claims 4 or 5,herein both stations choose at random phase shifts applied to said firstand second pulses.
 7. Method according to claim 6, wherein said phaseshifts are chosen as either the value 0 or the value π, and wherein theinterference between said first pulse and said second pulse isconstructive when both stations have applied the same phase shift, andtotally destructive when they apply different phase shifts.
 8. Methodaccording to claim 1, wherein said pulses include at least twoorthogonal polarization components; and herein said components traversethe same branches of the interferometric system, each of said componentstraversing the same branches in a different sequence.
 9. Methodaccording to claim 8, wherein one of said stations chooses at random thephase of one of the above polarization components with respect to thephase of another polarization component, thus creating a random outputpolarization.
 10. Interferometric system configured for the distributionof a key over a quantum channel using quantum cryptography, comprising:at least one sending/receiving station and at least one key encodingstation, both coupled to said quantum channel, means in at least one ofsaid stations for sending at least two light pulses over said quantumchannel to at least one other said station, detectors in at least one ofsaid stations for detecting interference created by said pulses in saidstations, wherein said light pulses traverse the same branches of theinterferometric system, each of said pulses traversing the same branchesin a different sequence so that said pulses are delayed when traversingsaid quantum channel.
 11. System according to claim 10, wherein at leastone of said stations comprises at least one Faraday mirror on at leastone end of said quantum channel.
 12. System according to one of claims10 or 11, wherein at least one of said stations comprises means forattenuating the intensity of said light pulses so that the averagenumber of photons in said pulses is less than
 1. 13. System according toclaim 10, wherein said at least two light pulses include a first pulseand a second pulse; said sending/receiving station includes a delay linefor delaying said first pulse before it is sent over said quantumchannel and said second pulse received over said quantum channel, and atleast one single photon detector for detecting interference between saidfirst and second pulses; and said key encoding station includes mirrorsfor reflecting said first and second pulses and at least one phasemodulator for modulating the phase of at least one of said pulses. 14.System according to claim 13, wherein said key encoding stationcomprises means for attenuating the intensity of at least one of saidpulses so that the average number of photons in said second pulsereflected back to said sending/receiving station is less than
 1. 15.System according to claim 13, wherein both stations choose at randomphase shifts applied to said first and second pulses.
 16. Systemaccording to claim 15, wherein both stations choose said phase shifts aseither the value 0 or the value π, and wherein the interference betweensaid first pulse and said second pulse is constructive when bothstations have applied the same phase shift, and totally destructive whenthe stations have applied different phase shifts.
 17. System accordingto claim 10, wherein the light pulses sent by said sending/receivingstation comprise at least two orthogonal polarization components, andwherein said components traverse the same branches of saidinterferometric system, each of said components traversing the samebranches in a different sequence.
 18. System according to claim 17,wherein one of said stations chooses at random the phase of one of saidpolarization components with respect to another polarization component,thus creating a random output polarization.
 19. Key encoding station forcommunicating a key to at least one sending/receiving station through aquantum channel comprising: reflecting means for reflecting a firstpulse sent by a receiving station back to said receiving station;reflecting means for reflecting a second pulse, sent by said receivingstation shortly after said first pulse, back to said receiving station;and modulating means for modulating the phase of said second pulse withrespect to said first pulse.
 20. Key encoding station according to claim19, further comprising detecting means for detecting said first pulse.21. Key encoding station according to claim 20, wherein said first pulseand said second pulse both run through said modulating means and areboth reflected by the same reflecting means; and wherein said detectingmeans adjust the phase shift applied by said modulating meansimmediately after having received said first pulse, so that only saidsecond pulse is phase modulated by said phase modulating means.
 22. Keyencoding station according to claim 21, wherein the key encoding stationchooses at random the phase shift applied to said second pulse.
 23. Keyencoding station according to claim 21, wherein the phase shift appliedby said modulating means is chosen at random among as either the value 0or the value π.
 24. Key encoding station according to claim 19, furthercomprising an attenuating means for attenuating the light intensity ofsaid second pulse so that the average number of photons in said secondpulse reflected back is less than
 1. 25. Key encoding station accordingto claim 24, wherein said attenuating means comprises a coupler sendingmost of the received light to said detecting means.
 26. Key encodingstation according to claim 24, wherein said attenuating means comprisean attenuator controlled by said detecting means.
 27. Key encodingstation according to claim 19, wherein said reflecting means arecomposed of a Faraday mirror.
 28. Key encoding station according toclaim 20, wherein said detecting means are not single-photon detectors.29. Key encoding station according to claim 19, wherein said modulatingmeans are made of a Lithium Niobate (LiNbO₃) modulator. 30.Sending/receiving station for receiving a key sent from one key encodingstation through a quantum channel, comprising: a pulsed laser source; adelay line; detecting means; and a first coupler connected in such a waythat the pulses emitted by said pulsed laser source are split in twopulses; wherein said delay line is configured such that a first splitpulse is directly sent to said quantum channel and a second split pulseis delayed by said delay line before being sent to said quantum channel;and wherein the pulses received from said quantum channel are split intwo pulses, the first pulse being directly sent to said detecting meansand the second pulse being delayed by said delay line before being sentto said detecting means.
 31. Sending/receiving station according toclaim 30, further comprising modulating means for modulating the phaseof the received pulses delayed by said delay line.
 32. Sending/receivingstation according to claim 31, wherein said modulating means choose atrandom phase shifts applied to said delayed pulses. 33.Sending/receiving station according to claim 32, wherein said modulatingmeans choose said phase shifts at random as either the value 0 or thevalue π.
 34. Sending/receiving station according to one of the claims 31to 33, wherein said modulating means are made of a Lithium Niobate(LiNbO₃) modulator.
 35. Sending/receiving station according to claim 30,further comprising two detectors, wherein said first coupler is a 3×3coupler connected to said detectors, and wherein a pulse will be senteither to the first or to the second of said detectors depending on theinterference created in said coupler.
 36. Sending/receiving stationaccording to claim 30, wherein said laser source sends light pulses witha circular polarization, and wherein said first coupler is apolarization coupler that separates the vertical and horizontalpolarizations of the pulses.
 37. Sending/receiving station according toclaim 30, wherein said delay line comprises two Faraday mirrorsreflecting the delayed pulses.
 38. Sending/receiving station accordingto claim 30, wherein said detecting means are single-photon detectors.39. Sending/receiving station according to claim 38, wherein saidsingle-photon detectors are avalanche photo diodes biased beyond reversebreakdown and operating in the Geiger mode.
 40. Sending/receivingstation according to claim 38, wherein the single-photon detectors areactivated only each time a photon is expected.
 41. Sending/receivingstation according to claim 30, wherein said pulsed laser source is a DFBlaser.
 42. Sending/receiving station according to claim 30, furthercomprising error correcting means.
 43. Device for the distribution of akey over a quantum channel using quantum cryptography, comprising asending/receiving station according to claim 30 and a key encodingstation according to claim
 20. 44. Multi-station system for thedistribution of a key over a quantum channel using quantum cryptographybetween at least one sending/receiving station and at least one keyencoding station, comprising at least one sending/receiving stationaccording to claim 30 and at least one key encoding station according toclaim 20.